62 lines
3.1 KiB
Markdown
62 lines
3.1 KiB
Markdown
# NOT RUN — the GraphQL bootJar JWT qualification
|
|
|
|
Recorded as not-run with its reason, per this wave's rule that a gate which could not run is never
|
|
reported as passing.
|
|
|
|
## What was attempted
|
|
|
|
```bash
|
|
cd src
|
|
./gradlew :app-bootstrap:graphqlRuntimeQualification --console=plain
|
|
```
|
|
|
|
```
|
|
* What went wrong:
|
|
Cannot locate tasks that match ':app-bootstrap:graphqlRuntimeQualification' as task
|
|
'graphqlRuntimeQualification' not found in project ':app-bootstrap'.
|
|
exit=1
|
|
```
|
|
|
|
## Why it cannot run
|
|
|
|
The task does not exist, and neither does the source set the spec names for it.
|
|
`app-bootstrap/src/` holds `main`, `test`, `functionalTest`, `conditionalTransportTest` and
|
|
`sampleOffTest` — there is no `graphqlRuntimeQualificationTest`.
|
|
|
|
The spec (`…-five-adapter-runtime-remediation-review-design.md`, GraphQL section) fixes the
|
|
canonical task as `:app-bootstrap:graphqlRuntimeQualification`, depending on `bootJar`, running the
|
|
produced jar as a child process, taking a client-credentials token from a Keycloak container that
|
|
imported the same tracked realm artifact, and calling real HTTP `/graphql`. None of that machinery
|
|
was built.
|
|
|
|
## What exists instead, and why it does not substitute
|
|
|
|
| Artefact | What it actually proves | Why it is not release evidence |
|
|
| --- | --- | --- |
|
|
| `GraphqlHttpBoundaryQualificationTest` | `/graphql` and `/graphiql` answer over HTTP in a `@SpringBootTest` | authenticates with `withBasicAuth(USERNAME, PASSWORD)` and `httpBasic(Customizer.withDefaults())` — test-only Basic auth, not the JWT decoder a deployment runs |
|
|
| `ConditionalTransportCompositionContractTest` | the GraphQL types load and the leaf's runtime membership matches the registry | `assertThatCodeLoads(typeName)` is class existence; it makes no request and sees no token |
|
|
|
|
The spec anticipates exactly these two and rules both out by name: the boundary test "may remain a
|
|
module contract test but is not aggregated into release evidence", and class existence is named as
|
|
the thing the qualification exists to replace.
|
|
|
|
## Consequence for the Definition of Done
|
|
|
|
Spec §13 item — *"GraphQL blocking qualification runs the bootJar JWT composition exactly once and
|
|
uses neither class-existence nor test-only Basic Auth as release evidence"* — **cannot be ticked**.
|
|
It is the one item of the twenty-four in that state.
|
|
|
|
## This was already declared, not discovered
|
|
|
|
`.github/ci-gate-matrix.yml` registers the gate as `mechanism: delegated-pending` with the comment
|
|
that it "inherits that control's pending status rather than having none of its own", and
|
|
`verify-gate-matrix.sh` reports `49 gates, 45 verified, 4 delegated-pending`. The gap is recorded in
|
|
the repository's own control plane; this file is the Wave 6 confirmation of it, not a new finding.
|
|
|
|
## What closing it would take
|
|
|
|
A new `graphqlRuntimeQualificationTest` source set, a Gradle lane depending on `bootJar`, a child
|
|
process launcher for the jar, a Keycloak container importing `infra/keycloak/realms/
|
|
ca-skeleton-realm.json`, and the required-class / zero-discovery / stale-XML refusals the spec lists.
|
|
That is new capability, which this wave explicitly does not add.
|